Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Workspace Organization - Automated Health Checks Automated workspace health checks and entropy prevention for OpenClaw. Detects broken symlinks, empty dirs, large files, malformed names. Maintenance audit s... | |
| Zero Trust Protocol - Security-First Agent Guidelines Zero-trust security framework for AI agents. Verification flow for all external actions, URL interactions, installations, and credential handling. Prevents p... | |
| PrusaLink OpenClaw skill: local PrusaLink CLI (curl wrapper) for status/upload/print using Digest auth (user/password) or optional X-Api-Key. | |
| remote-macos-computer-use Set up and use cua-driver (an MCP server) so an AI agent running on a remote/cloud host can drive a macOS desktop, with a persistent background daemon + reverse-SSH-tunnel wiring that survives reboots and stays in the background. Use when y | |
| excel去重清洗 Excel 表格去重清洗。自动去除多余空格、全角字符转半角、标准化手机号和身份证号、按关键列（姓名/手机号/编号）去重，并生成清洗报告 sheet。当用户上传含脏数据的 xlsx/csv 并要求"去重"、"清洗数据"、"数据标准化"、"处理表格里的重复行"时触发。 | |
| excel-split-by-column 按指定列的值把一张 Excel 大表拆分成多个工作表（单文件）或多个独立 xlsx 文件。自动检测拆分列（部门/城市/分类/状态类），处理非法 sheet 名、空值归组"未填写"，并生成拆分汇总。当用户上传大表并要求"按部门拆开"、"按城市分成多个表"、"拆分成多个文件"、"分类拆分"时触发。 | |
| OpenClaw Status API Provides real-time OpenClaw agent statuses, cron job health, platform uptime, geocoding, and weather data via a paid API. | |
| 鲁班 | Luban 打磨工坊 鲁班（Luban）——Skill打磨工坊。把一个"能用的Skill"打磨成"能被理解、能被安装、能被传播、能被验证、能持续进化"的公共Skill资产。 方法论是工匠式的五个动作：验料（先挑战这个Skill的前提是否成立，不值得雕的料直说）、访行（联网寻找同类Skill，看清自己在生态里站什么位置）、过尺（结构、实... | |
| Skill Sync Audit and converge local skills across Codex, Claude, OpenClaw, OpenCode, workspace skills, and shared agent libraries; compute a hygiene score, classify sha... | |
| tagclaw The social network skill for AI agents on TagAI. Skills include Post, reply, like, retweet, follow other agents, and wallet operations(Create token for a tick, trade tokens, trade IPShares, stake tokens, claim rewards, etc.). | |
| A-Share Review and Analyse A-share market automated review and analysis system, generating daily market insights with Gemini AI, supporting publishing to Hugo blog and WeChat Official... | |
| Auto Research Claw Automates research by conducting literature searches, running experiments, and generating LaTeX papers from detailed research topics. | |
| Shodh Local Local offline cognitive memory for AI agents providing semantic recall, GTD todos/projects, and a knowledge graph with Hebbian learning and a TUI dashboard. | |
| Zero Trust Security-first behavioral guidelines for cautious agent operation. Use this skill for ALL operations involving external resources, installations, credentials, or actions with external effects. Triggers on - any URL/link interaction, package | |
| Mem Optimizer 记忆优化与压缩工具。结合 self-improving 机制，自动统计、压缩和优化记忆文件，减少 token 消耗。支持多智能体优化和24小时工作检测。触发关键词：优化记忆、记忆优化、总结你自己、MemOptimizer、memopt、执行多智能体记忆优化流程 | |
| network-device-scanner 扫描局域网内活跃设备及其开放端口，返回格式化Markdown表格。触发场景：(1) 用户说"查一下周边设备有哪些"、"扫描周边设备"、"看看网络有哪些设备"、"局域网有哪些设备" (2) 用户提到IP地址、MAC地址、端口扫描相关的查询 | |
| Ai Image Prompts Recommend curated prompts from a 10,000+ real-world image generation prompt library. Works with ANY AI image model — Nano Banana Pro, Nano Banana 2, Seedream... | |
| birdx X/Twitter CLI that reads Chrome cookies directly from disk — no browser session required after first auth. Supports reading tweets with viewCount/bookmarkCou... | |
| Grok Imagine Prompts Search community-curated Grok Imagine video generation prompts from X/Twitter. Grok Imagine is xAI's AI video generation model — these prompts are specifical... | |
| Nano Banana Pro Prompts Search and recommend suitable prompts from 10,000+ Nano Banana Pro image generation prompts based on user needs. Optimized for Nano Banana Pro (Gemini), but... | |
| Nano Banana Pro Prompts Recommend Recommend suitable prompts from 14,000+ Nano Banana Pro image generation prompts based on user needs. Optimized for Nano Banana Pro (Gemini), but prompts als... | |
| Seedance 2 Prompts Search Seedance 2.0 video generation prompts curated from the community. ByteDance AI video model — find cinematic, realistic, animated, and creative video p... | |
| YouMind Blog Cover Generate blog cover images optimized for 16:9 headers — clean composition with text-friendly layouts, powered by multi-model AI. Use when user wants to "blog... | |
| AI Deep Research Agent Conduct deep research on any topic — get comprehensive reports with citations, key findings, and actionable insights in minutes. Use when user wants to "deep... | |
| AI Image Generator Generate AI images from text prompts — one API key for GPT Image, Gemini, Seedream, and 10+ models. No juggling subscriptions. Images saved to your YouMind k... | |
| AI Slides & Presentation Generate professional presentation slides from a topic or outline — complete decks you can view, edit, and download. Use when user wants to "create slides",... | |
| Save Link & Web Clipper Save any URL to your YouMind board with one command — instant web clipper for articles, videos, and documents. Works from terminal, CI/CD, and any agent plat... | |
| Youmind Youtube Transcript Extract YouTube video transcripts and subtitles via YouMind API — no yt-dlp, no proxy, no local dependencies. Batch extract up to 5 videos at once with paral... | |
| dopost-api Use the Dopost REST API to publish, schedule, and manage social media posts programmatically. Use this skill when the user wants to publish to social media,... | |
| NPC浓度测试 游戏 NPC 之所以是 NPC 是有规律的，「这个世界」里你之所以像 NPC 也是这几条规律——恐怕吻合得有点残忍…… 测出你在「这个世界」里被分配的角色——可能是把「好的收到」说了一万次的路人甲，可能是活越干越多但署名栏永远没你的铁匠，也可能是每天都在公开频道喊话但没人回应的公告员。 不联网，不留档，答完只在你手里。 | |
| 大学避坑指南 大学里那些不好意思问朋友、也不想跟家里说的事，都能扔给我——室友太吵、挂科了咋办、生活费不够花、兼职是不是坑、心里堵得慌。我会按你的当下状态给你实在话，不灌鸡汤，也不替你下结论。 | |
| 本命灵根测试 道友请留步！来答修仙情境题，测测你的本命灵根，获取专属道友帖吧！ | |
| 魔杖选择你 想知道哪根魔杖在等你？走进魔杖商店，让店主替你找到那根属于你的魔杖！不用填表、不用写长串回复，全程就像逛街一样轻松：选我是谁——告诉我「选魔杖」「我的魔杖是什么」或「进店逛逛」，开启测试；点着答——一题一题来，点选答案就够了，选过的自动记住，不累也不易混；一键出卡——答完点「提交判定」，专属杖卡立刻出炉：木材·杖芯·英寸·韧度，世上仅此一根。答累了也不怕：已答 8 题，随时说「就到这里」，剩下的题杖替你答，照样提前出卡。还能「两杖相照」：把朋友的杖码粘进来，看你们是同一棵树、 | |
| 分院帽 分院帽人格测试（随机抽卷 + 麻瓜词典）。当用户说「给我分院」「我是哪个学院」「测测我适合哪个学院」「戴帽子」「霍格沃茨分院」时使用，用户抱怨「手打答案串太累/怕把题目搞混」时也直接走这里。首选生成单文件点选答题页：一屏一题、随机抽卷、点选即记住、答完点「提交判定」出卡；纯文本通道走三轮闭环，一屏出题 + 卷号 + 答案串回传。 | |
| Academic Writing Test Expert assistance in scholarly writing, including research papers, literature reviews, methodology, and theses, with strict adherence to academic standards a... | |
| OpenClaw Backup Rclone 自动备份 OpenClaw 整体配置到远程存储（支持任意 rclone 后端：COS、S3、FTP、SFTP、WebDAV等）。 触发场景： - 创建/配置自动备份任务 - 设置备份周期、保留份数、目标目录 - 手动触发备份 - 查看/恢复备份 - OpenClaw 运行异常时的提醒 | |
| OpenClaw Watchdog Pro OpenClaw 跨平台配置备份与网关监控。自动备份 openclaw.json，每分钟检查 gateway 状态，宕机时自动恢复。支持 Linux/macOS/Windows。触发：配置备份、gateway 监控、自动恢复、看门狗、watchdog。 | |
| scihub-downloader Automation skill for scihub-downloader. | |
| 知乎热搜 获取知乎每日热搜榜单，支持搜索、统计、范围分析。数据从 2021-01-08 至今。 | |
| pua-debugging-pro Professional anti-giveup debugging protocol for coding tasks where the agent starts looping, deflecting to users, or trying to end early without evidence. Us... | |
| NadirClaw Install, configure, and run NadirClaw LLM router to cut AI API costs by 40-70%. Use when the user wants to reduce LLM spending, route prompts to cheaper mode... | |
| Kimi Code Quota Query Kimi Code Plan quota and usage information. Use when the user wants to check their Kimi Code subscription quota, usage percentage, reset time, or API k... | |
| 小米 TTS Proxy 小米 TTS 代理技能。将 OpenAI TTS API 格式转换为小米大模型平台 TTS API（api.xiaomimimo.com），支持 Opus/MP3/AAC/FLAC/WAV/PCM 六种格式的本地转码。 当需要为机器人添加语音回复能力、或配置 TTS 语音合成时使用此技能。 也适用于需要搭建本地... | |
| Create Project Interactive Orchestrix project scaffolding. Creates project directory under ~/Codes/, generates project brief from Q&A, installs MCP config, hooks, slash com... | |
| Orchestrix Guide Orchestrix multi-agent workflow guide for OpenClaw. Defines two operational phases: (1) Planning Phase — sequential agent orchestration in a single tmux wind... | |
| Claw Mission Killer Interrupt a running agent task and rollback its session to the state before the last triggering user message. Use when an agent is stuck, running the wrong t... | |
| 4to1 Planner Bak AI planning coach using the 4To1 Method™ — turn 4-year vision into daily action. Connects to Notion, Todoist, Google Calendar, or local Markdown. Use when us... | |
| Crypto Sniping Automated Binance bot using RSI, MACD, volume spikes, and whale tracking to generate signals, execute trades, and manage risk on BTC, ETH, and SOL. | |
| Dharma Learning Autonomous Buddhist learning skill with web search, local Dharma database, and Middle Way view. Dedicated to the long lives of HH Dalai Lama and Khen Rinpoch... | |
| Document Congruence Checker Compare multiple documents for congruency and consistency. Use when: User needs to verify that multiple documents (contracts, reports, forms, specs) contain... |
26,751–26,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.